"Record of death" vulnerability in OpenSSL 0.9.8f through 0.9.8m
In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL.
Affected versions depend on the C compiler used with OpenSSL:
- If 'short' is a 16-bit integer, this issue applies only to OpenSSL 0.9.8m.
- Otherwise, this issue applies to OpenSSL 0.9.8f through 0.9.8m.
Users of OpenSSL should update to the OpenSSL 0.9.8n release, which contains a patch to correct this issue. If upgrading is not immediately possible, the source code patch provided in this advisory should be applied.
Bodo Moeller and Adam Langley (Google) have identified the vulnerability and prepared the fix.
In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL.
Affected versions depend on the C compiler used with OpenSSL:
- If 'short' is a 16-bit integer, this issue applies only to OpenSSL 0.9.8m.
- Otherwise, this issue applies to OpenSSL 0.9.8f through 0.9.8m.
Users of OpenSSL should update to the OpenSSL 0.9.8n release, which contains a patch to correct this issue. If upgrading is not immediately possible, the source code patch provided in this advisory should be applied.
Bodo Moeller and Adam Langley (Google) have identified the vulnerability and prepared the fix.
Last edited by a moderator:
